- Social media platforms must prevent children from using VPNs to circumvent the ban
- The eSafety Commissioner refuses to say how this will actually work
- Children will likely find solutions, but privacy may be at risk
Social media platforms affected by Australia’s under-16 ban are “expected to try to prevent users from using VPNs to pretend to be outside Australia,” according to guidance issued by the eSafety Commissioner.
When TechRadar asked the commissioner’s office to clarify how platforms are expected to achieve this technically, a spokesperson declined to comment.
Despite widespread support for the legislation in the country, enforcement remains a critical concern for lawmakers and parents alike.
In an email to TechRadar, Dr. Justine Humphry – co-author of the University of Sydney’s Emerging online safety issues report –: “86% of parents said we need effective age limits on apps and platforms, but 86% of young people and 83% of parents said young people would circumvent these.”
To comply with the restrictions, social media platforms may attempt to identify and blacklist IP addresses associated with popular VPN services. However, this often creates a “cat-and-mouse” dynamic: As platforms block specific servers, VPN companies simply deploy new IP addresses to circumvent the restrictions.
This approach also creates significant security vulnerabilities, potentially blocking legitimate adult users from using a VPN to protect their data and increase their digital privacy.
Alternatively, social media platforms could deploy deep packet inspection (DPI) technology to analyze internet traffic data and identify VPN-specific fingerprints.
This works because VPN protocols like OpenVPN and WireGuard have different features, meaning that VPN traffic looks different from standard web traffic. However, some VPNs with specialized obfuscation techniques – such as Surfshark and Proton VPN – can overcome this.
Realistically, social media platforms will likely simply cross-reference a user’s IP address with their GPS coordinates and/or the user’s historical IP addresses. Since users often grant location data permissions to tag posts or discover “local” content, comparing these coordinates to an IP address provides an incredibly effective method of detecting active VPNs.
Will VPNs enable children to bypass the ban?
Interest in VPNs has increased in regions that have recently introduced strict content restrictions. In Missouri, search traffic for VPNs quadrupled after the introduction of mandatory age verification, while the UK saw a 1,400% increase in sign-ups for some providers following the Online Safety Act. And it is likely that a similar trend will emerge in Australia.
Currently, Google Trends data shows no immediate increase in search interest, yet several popular VPNs – including ExpressVPN and NordVPN – are among Australia’s top-grossing utility apps, according to Sensor Tower data.
“The use of VPN services is an option and should be monitored to see if there are download increases,” said Dr. Humphrey.
But their ability to circumvent these restrictions will largely depend on the measures put in place by social media platforms. Given that these platforms often have access to detailed device data – including GPS, SIM card country and advertising IDs – a simple IP change is unlikely to change much.
Platforms likely rely on historical IP data and are already deactivating accounts. So if a user’s “digital footprint” shows years of access predominantly from Australian IP addresses, a sudden switch to an overseas location is highly unlikely to work.
Despite this, we still expect there to be an increase in demand for VPN services as people seek to increase their security and privacy online. A major concern, however, is that younger users will inevitably turn to “free” VPN services in the hope of bypassing controls, but these are often dangerous.
Free VPNs often monetize user data by selling it to third-party advertisers, may lack necessary encryption standards, and may even inject malware onto devices. If you or your child are considering a VPN, it’s critical to use a reputable service with a verified no-logs policy. We then recommend checking out TechRadar’s best VPN guide for the most secure and reliable apps on the market right now.
Perhaps even more worrying is the emergence of new platforms specifically tailored to under 16s. These lead to a new – and potentially even more dangerous – set of cybersecurity and digital privacy challenges.
We test and review VPN services for legitimate recreational use. For example: 1. Accessing a Service from another country (subject to the terms and conditions of that Service). 2. Protecting your online security and enhancing your online privacy when you are abroad. We do not support or condone the use of a VPN service to break the law or carry out illegal activities. Consumption of paid-for pirated content is neither endorsed nor endorsed by Future Publishing.
